Search found 12 matches

Go to advanced search

by fumfel
2017-11-15T05:40:51-07:00
Forum: Bugs
Topic: Negative size parameter in RemoveResolutionFromResourceBlock()
Replies: 0
Views: 17496

Negative size parameter in RemoveResolutionFromResourceBlock()

After some fuzz testing I found a crashing test case.

Git HEAD: a2d7a71ee37dca68f32bd2ed4e9c7299a6d78a77

OS & Compiler: Ubuntu 16.04 x64 + Clang 4.0

Faulting input: https://frankowicz.me/storage/crashes/im_negative_size_RemoveResolutionFromResourceBlock

Command: convert im_negative_size ...
by fumfel
2017-10-16T01:22:14-07:00
Forum: Bugs
Topic: Use after free in GetPixelInfoPixel()
Replies: 1
Views: 5373

Use after free in GetPixelInfoPixel()

After some fuzz testing I found a crashing test case.

Git HEAD: f0d6dde21d77905c0c3769c2d3491365d518c844

OS & Compiler: Ubuntu 16.04 x64 + Clang 4.0

Crashing file: https://frankowicz.me/storage/crashes/im_uaf_GetPixelInfoPixel

Command: convert im_uaf_GetPixelInfoPixel /dev/null

ASAN ...
by fumfel
2017-09-18T23:46:42-07:00
Forum: Bugs
Topic: Heap buffer overflow in GetNextToken()
Replies: 1
Views: 13732

Heap buffer overflow in GetNextToken()

After some fuzz testing I found a crashing test case.

Git HEAD: 4e46ad9dd95d68c1c8c630e6d27338ae3f57d5c7

OS & Compiler: Ubuntu 16.04 x64 + Clang 4.0

Command: convert im_hbo_GetNextToken.svg /dev/null

Faulting input: https://frankowicz.me/storage/crashes/im_hbo_GetNextToken.svg

ASAN:

==6443 ...
by fumfel
2017-09-14T11:33:27-07:00
Forum: Bugs
Topic: Null pointer dereference in GetJPEGMethod()
Replies: 1
Views: 5037

Null pointer dereference in GetJPEGMethod()

After some fuzz testing I found a crashing test case.

Git HEAD: 4e46ad9dd95d68c1c8c630e6d27338ae3f57d5c7

OS & Compiler: Ubuntu 16.04 x64 + Clang 4.0

Command:

convert im_nullptr_GetJPEGMethod /dev/null

Faulting input: https://frankowicz.me/storage/crashes/im_nullptr_GetJPEGMethod

ASAN ...
by fumfel
2017-09-04T12:28:14-07:00
Forum: Bugs
Topic: Use-after-free in TIFFSetField()
Replies: 3
Views: 16682

Re: Use-after-free in TIFFSetField()

Reply from LibTIFF developer: http://bugzilla.maptools.org/show_bug.cgi?id=2730#c3
by fumfel
2017-08-28T01:26:30-07:00
Forum: Bugs
Topic: Heap buffer overflow in TracePoint()
Replies: 2
Views: 16011

Heap buffer overflow in TracePoint()

After some fuzz testing I found a crashing test case.

Git HEAD: b0323e6509f4530a228c8788db11a49ff9255b69

OS & Compiler: Ubuntu 16.04 x64 + Clang 4.0

Command: convert im_hbo_TracePoint /dev/null

Faulting input: https://frankowicz.me/storage/crashes/im_hbo_TracePoint.svg

ASAN:


==21950==ERROR ...
by fumfel
2017-08-23T08:38:02-07:00
Forum: Bugs
Topic: Use-after-free in TIFFSetField()
Replies: 3
Views: 16682

Use-after-free in TIFFSetField()

More details and faulting test case: http://bugzilla.maptools.org/show_bug.cgi?id=2730
by fumfel
2017-08-23T06:29:42-07:00
Forum: Bugs
Topic: Heap out of bounds read in .omp_outlined..68()
Replies: 2
Views: 5788

Re: Heap out of bounds read in .omp_outlined..68()

With '--disable-openmp' switch, problem doesn't exists.
by fumfel
2017-08-22T14:13:35-07:00
Forum: Bugs
Topic: Heap out of bounds read in .omp_outlined..68()
Replies: 2
Views: 5788

Heap out of bounds read in .omp_outlined..68()

After some fuzz testing I found a crashing test case.

Git HEAD: eb56534ac870d9a5b8a6e7db8d32c0e76ae65924

OS & Compiler: Ubuntu 16.04 x64 + Clang 4.0

Command: convert im_hoobr_omp_outlined.eps null

Faulting input: https://frankowicz.me/storage/crashes/im_hoobr_omp_outlined.eps

ASAN:

==13673 ...
by fumfel
2016-09-20T08:55:41-07:00
Forum: Bugs
Topic: Memory leak in API
Replies: 1
Views: 4302

Memory leak in API

IM Version (compiled from source):
Version: ImageMagick 7.0.3-0 Q16 x86_64 2016-09-14 http://www.imagemagick.org

Source file

To reproduce:
convert crash.dib a.jpg
LeakSanitizer output:
==535==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 4160 byte(s) in 1 object(s) allocated ...
by fumfel
2016-09-20T08:44:46-07:00
Forum: Bugs
Topic: Memory leak in GIF parser
Replies: 1
Views: 4457

Memory leak in GIF parser

IM Version (compiled from source):
Version: ImageMagick 7.0.3-0 Q16 x86_64 2016-09-14 http://www.imagemagick.org

Source file

To reproduce:
convert crash.gif a.jpg
LeakSanitizer output:
==32663==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 13304 byte(s) in 1 object(s ...
by fumfel
2016-09-20T06:49:16-07:00
Forum: Bugs
Topic: Memory leak in WPG parser
Replies: 1
Views: 4087

Memory leak in WPG parser

When I try convert malformed WPG image, ImageMagick leaks memory in WPG parser.

IM Version (compiled from source):
Version: ImageMagick 7.0.3-0 Q16 x86_64 2016-09-14 http://www.imagemagick.org

Source file

To reproduce:
convert crash.wpg a.jpg
LeakSanitizer Output:
==19859==ERROR ...

Go to advanced search